fastapi-jwt

# FastAPI JWT Middleware Skill

## Purpose
This skill provides implementation details for secure JWT verification middleware in FastAPI, specifically integrated with Better Auth secrets.

## Capabilities
- Secure JWT extraction from Bearer headers
- Signature verification using `BETTER_AUTH_SECRET`
- Decoding and extraction of `user_id` and `email`
- Route-level ownership validation (matching `user_id` to route paths)
- Dependency injection patterns for FastAPI routes
- Standardized error handling (401/403 HTTPExceptions)

## Implementation Details

### JWT Extraction & Verification
Extract the token from the `Authorization` header and verify it against the `BETTER_AUTH_SECRET` environment variable.

### Data Model
Ensure the decoded payload contains:
- `user_id`: The unique identifier for the user.
- `email`: The user's email address.

### Permissions
Implement a check to ensure that if a `user_id` is present in the route path, it matches the `user_id` in the JWT payload.

### Error Handling
- Raise `401 Unauthorized` if the token is missing, invalid, or expired.
- Raise `403 Forbidden` if the `user_id` validation fails.

## Usage
Include the middleware as a dependency in FastAPI routes:

```python
@app.get("/users/{user_id}/profile")
async def get_profile(user_id: str, user: User = Depends(get_current_user)):
    # get_current_user logic handles JWT and user_id matching
    ...
```